The Infrastructure Bottleneck for Most Migrations
Public key infrastructure is the bottleneck for most enterprise PQC migrations. Post-quantum certificates are dramatically larger than their classical counterparts, with cascade effects on certificate chains, validation, OCSP responses, TLS handshakes, and HSM storage. This in-depth, 8-hour course covers PKI modernization for the post-quantum era: dual-capability PKI design, certificate chain-size consequences, HSM inventory and firmware paths, trust anchor migration, and certificate lifecycle management during the transition.
Who Should Take This Course
PKI engineers, certificate authority administrators, cryptographic engineers, and security architects responsible for public key infrastructure.
What You Will Learn
This course provides hands-on technical depth in a specific dimension of PQC migration, aligned with the PQC Migration Framework. You will gain practical, applicable skills you can use immediately in migration work.
Course Outline
Module 1 — The Post-Quantum PKI Challenge
Why PKI is the infrastructure bottleneck. The certificate size problem: ML-DSA signatures are roughly an order of magnitude larger than ECDSA. Cascade effects: chain validation, OCSP response sizes, TLS handshake latency, and storage. Assessing your PKI’s readiness for post-quantum certificates.
Module 2 — Dual-Capability PKI Design
Designing PKI that supports both classical and post-quantum certificates during transition. Dual-certificate hierarchies. Cross-signing strategies. Composite and hybrid certificate approaches. Managing two trust hierarchies in parallel.
Module 3 — HSM and Trust Anchor Migration
HSM inventory and PQC support assessment. Firmware upgrade paths and vendor timelines. Trust anchor migration strategies. Root and intermediate CA migration sequencing. Key ceremony considerations for post-quantum roots.
Module 4 — Certificate Lifecycle During Transition
Certificate lifecycle management with dual algorithms. Issuance, renewal, and revocation during transition. Automating certificate management for the migration. Monitoring and inventory for a mixed classical/post-quantum certificate estate.
Module 5 — Protocol and Application Impact
How PKI changes affect TLS, code signing, S/MIME, and document signing. Application compatibility with larger certificates. Performance testing for PKI-dependent systems. Managing the transition for systems that cannot handle larger certificates.
Module 6 — Migration Planning and Execution
Building a PKI migration plan. Sequencing PKI migration relative to the broader cryptographic migration. Testing and validation for PKI changes. Rollback planning. Coordinating PKI migration across the organization and with external partners.
Prerequisites
A working understanding of PQC fundamentals is recommended. Consider Post-Quantum Foundation or PQCS certification for background. Some courses assume security engineering experience.
Certificate of Completion
Upon completion, you will receive a Quantum Academy certificate of completion. CPE credits earned may apply toward Quantum Academy certification maintenance.